Posted
by
Soulskillon Monday March 08, 2010 @12:49PM
from the bad-bunny dept.

swandives writes "Researchers at US-CERT have warned that software accompanying the Energizer DUO USB battery charger contains a Trojan that gives hackers total access to a Windows PC. The product was sold in the US, Latin America, Europe and Asia starting in 2007. Upon installation, the software creates the file 'Arucer.dll,' a Trojan that listens for commands on TCP port 7777. Upon receiving instructions, the Trojan can download and execute files, transmit files stolen from the PC, or tweak the Windows registry. Uninstalling the software disables the automatic execution of the Trojan. Users can also remove Arucer.dll from Windows' system32 directory and reboot the machine to disable the backdoor component."

Interesting that Arucer.dll is (aside from an extra 'r') an anagram for Energizer's competitor Duracell [wikipedia.org]. Perhaps the authors of the software thought Duracell was spelled 'Durracell'? And perhaps they decided to pick an anagram of the competitor to make it look as though Duracell is behind this?

There have been reports of Arucer.dll utilizing 100% CPU as far back as mid 2007. It was originally included by Energizer and used to check that the device was indeed connected to the machine.

They aren't sure how long dll has been infected, but all signs point to the entire time (back to May 2007). Considering how many forum posts have issues with the dll going back 2.5 years, you'd think someone would have figured it out long ago.

biggest ripoff ever.I use a modified multi outlet strip with banana plugs and an amp meter. more accurate, just as easy, and you can say "here hold these wires" and shock the living hell outa someone. Oh and you can measure neutral-ground leakage as well.

A driver should be aware of their fuel economy, but it's more likely the job of a specialist to determine why the fuel economy has changed. Knowing if the difference is due to the air filter/oil filter/radiator/spark plug/exhaust/fuel filter, or any of the other parts which could cause this problem is generally left to someone knowledgeable. The end-user should only be expected to notice the issue and request help, which it seems many did by requesting assistance on the company forums.

Since when has determining your processor utilization been considered basic competency? Get off you high horse.

I think it's intellectually dishonest to mention processor utilization as though that were the only possible way. I notice this frequently, that people are often rather eager to excuse and defend incompetent users out of some misguided sympathy for them. Real compassion for them would mean teaching, explaining, and providing good references for their edification. It would not mean excusing their failures or sugarcoating their incompetence. Any literate adult can achieve competency with a computer, and most problems that make the network a worse place for everyone directly involve users who lack knowledge, so why the "get off your high horse" spite towards those who expect better?

If anything, I think the "high horse" is the belief that users will always be ignorant, will always be victims of these security issues, and can never overcome them. It is not the belief that they can and should overcome them. That's especially evident to me when you have to (intentionally or otherwise) zero in on one particularly unlikely means of detection because you think ignoring other possibilities helps your case. This is known as confirmation bias, incidentally. In response, I'll give you a plausible scenario for which CPU utilization need not be measured.

I'll give another scenario under which this could have been detected. Here, when I say "firewall", I refer to Komodo, ZoneAlarm, and other software firewalls that are commonly available for Windows and/or free of charge, and are installed on millions of machines.

Running a firewall that could have alerted the user to suspicious/unprompted network activity is basic competency, right up there with running a virus scanner and an anti-spyware scanner. For Windows, these tools can be regarded as "maintainence", and anyone who operates a machine without correctly maintaining it (personally or by seeking help) cannot be rightly called competent. Now, basic competency may or may not correctly interpret that network activity, but that doesn't matter. It doesn't take computer expertise to say "hey, this firewall keeps asking me about things I don't understand and did not set up myself, so maybe I should get this computer looked at by a techie." At that point you're no longer talking about average users and whether they can achieve competency.

In many ways we are all guilty of being ignorant in one area or an other. However saying someone is stupid for not knowing how to do something or even look up how to do it is rude and unwarranted.

I have seen and met a lot of people who wouldn't know or even know to check the CPU usage on their PC however they are actually very smart and intelligent individuals. Why because they really could care less about their computer. It is an appliance for them, it does what they want them to do. It is using 100% cp

In many ways we are all guilty of being ignorant in one area or an other. However saying someone is stupid for not knowing how to do something or even look up how to do it is rude and unwarranted.

I was talking about this in terms of competency, not in terms of stupidity. For example, I am not a competent surgeon because I know absolutely nothing about surgery. That doesn't mean I'm stupid, it means I haven't gone to medical school. When I personally spoke about "competency" I meant it in this sense. I

Since about the time Windows came out with their Task Manager. Basic competency. Very basic. No one suggests that finding the executable, and disassembling it to find out what makes it tick is part of basic competency, but opening task manager to see which of your 97 active processes is using all of your computer time is indeed "basic".

Somewhere, above, in this conversation, someone already stated something to the effect "incompetent != stupid". People who can't find task manager may or may not be stupid, but they are definitely IN-FUCKING-COMPETENT!

Further, it has already been stated that you do the incompetent no service, and no justice, by making excuses for them. You'll do them a greater service by pointing out that they are incompetent, then help them to become competent.

Here, you are just running at the mouth, looking for a fight, when you don't even appear to understand what the fight is about.

Questioning other people's sense of security is usually a sign of an overinflated sense of superiority.

Kindly point out where I said that I'm "smarter" than people who can't find task manager. Can't find it? I'll thank you not to put words in my mouth, Mr. A.C.

I am incompetent in many areas. I probably couldn't get a Cessna started up, let alone take off with it. I CAN fire up a D-9 Caterpillar, and make a decent attempt at grading your property. Does my incompetence with aircraft make me stupid? Does

And, I insist, if a person is using a computer, and doesn't even know how to find the task manager, then he isn't competent to use the computer.

Car analogy? Where's the speedometer? The oil pressure guage? Ampmeter? Oh, you say, I have nothing but idiot lights, no guages? Fine. DO YOU SEE THE IDIOT LIGHTS? If you can't see the idiot lights, you obviously shouldn't be driving. Assuming you have guages, do you bother to look at them from time to time? No? Again, incompetent.

you think the Term 'hacker' and the term 'criminal' are mutually exclusive?
I know we spent a decade trying to show the world they are different,but even a technically skilled criminal can be a hacker.... he just has to wear a black hat while he does his deed.

you think the Term 'hacker' and the term 'criminal' are mutually exclusive?

No, but neither are the terms "accountant" and "embezzler," or "journalist" and "liar," or "priest" and "pedophile."

The problem with using the term "hacker" is as soon as you throw that term in to the conversation, it takes the spotlight off of the party that is actually responsible.

So Sony puts a root kit on your machine that could allow "hackers" to get control of it, it's those damn "hackers" who are the problem, not Sony. Perhaps not the best example to give, since Sony was heavily criticized for their actions (at least on Slashdot); but how many times have we seen stories about public servants losing laptops full of unencrypted information reported as "hackers could be accessing your private information."

The problem isn't some mythical "black hat" pounding furiously away at the keyboard as graphic images swirl around his head, it's that companies and government agencies are not taking due care with people private information, and frequently take liberties with their customers' property that would be considered criminal if it was your physical property they were abusing. Invoking the phrase "hacker" let's the real parties who are responsible off the hook.

In this case, I would be interested in knowing why Energizer has no idea how this trojan got in to their charger in the first place, and whether it was truly the work of a nefarious black hat, or a misguided attempt by the company to keep tabs on how customers are using their product.

Who knows, but as long as the focus is on "hackers" exploiting this trojan, rather than how it got bundled with the charger in the first place, it's unlikely we'll get the real story, or that the people who were really responsible will face any consequences.

Ubuntu does not equal Linux. Come on man! You probably have to wait for it to be packaged upstream. Besides, a DLL is a LIBRARY file. You should be looking for lib-arucer or something similar like waffles, or whatever the developer felt like naming it. If that doesn't work, try x-arucer, or switch to Gentoo. I am sure they can get it.

PS- Wine might run it, but you will probably need a patch. Try Cedega or Play-On-Linux, or qemu or dosbox.

It's called a DUO because it can plug into the wall or into a computer. So it works without a computer. To get the computer to jack up the USB power output from the default 100mA, the device could identify itself as a hub -- no software required.

I get it that the software can monitor charging, report stuff, advertise... But how does Energizer feel now, with egg on their faces?

I get it that the software can monitor charging, report stuff, advertise...

I always wondered, with the sheer amount of portable devices which charge over USB nowdays, why not put some manner of standardized charge reporting into the specs of the next version of USB, so that we don't need to bother with nonsense like installing a new program or drivers for each device just to monitor its charging on the computer (or whatever charger), if we do want monitoring and such? That way, we could just tack a charge indicator onto whatever the OS or windowing system uses to track connected USB devices, instead of X amount of additional programs displaying it in any variety of mismatched ways.

I mean, I'll grant that many devices just report their own charge on their own respective screens, so for things like phones or whatnot, it might not be that useful. Plus, my suggested scheme would quickly get shot down by companies like Energizer in this case when they realize revenue stream conduits^W^W^W customers wouldn't have a reason to install "special" drivers and programs loaded with ads...

I purchased a Sennheiser bluetooth headset, and it includes a USB charging cable and a wall adapter to plug it into. Additionally the jack is micro USB so in theory I should be able to use the whole thing to charge other things as well. I waste minimal power if I'm already using the computer and I can just plug it into the wall if I'm not. It's both convenient and well considered.

> I always wondered, with the sheer amount of portable devices which charge> over USB nowdays, why not put some manner of standardized charge reporting> into the specs of the next version of USB

You'd be surprised how lax are the implementations to "standards". I've worked with both USB memory sticks for.mp3s and Bluetooth phones, and the code to handle them is a morass of special cases per manufacturer. Not including the version number differences. That's within the same interface version.

I get it that the software can monitor charging, report stuff, advertise...

I always wondered, with the sheer amount of portable devices which charge over USB nowdays, why not put some manner of standardized charge reporting into the specs of the next version of USB, so that we don't need to bother with nonsense like installing a new program or drivers for each device just to monitor its charging on the computer (or whatever charger), if we do want monitoring and such? That way, we could just tack a charge indicator onto whatever the OS or windowing system uses to track connected USB devices, instead of X amount of additional programs displaying it in any variety of mismatched ways.

I mean, I'll grant that many devices just report their own charge on their own respective screens, so for things like phones or whatnot, it might not be that useful. Plus, my suggested scheme would quickly get shot down by companies like Energizer in this case when they realize revenue stream conduits^W^W^W customers wouldn't have a reason to install "special" drivers and programs loaded with ads...

Oh, yeah. That IS why it wouldn't get adopted. Hrm.

I have a better idea, Put the monitoring software on the device being charged.

Look damnit, if the free market thought there was an advantage to doing things your way then we'd all be growing our own battery chargers on government plantations. You presume to tell American businesses how to optimize their production lines? Nonsense and tosh! If you want something done a particular way, do it yourself! Your elitist attitude makes me sick.

The language code of the file is in Chinese - well they may have employed the manufacturer to write that.dll? I understand there's a chance that the hacker COULD BE Chinese but it's not even remotely conclusive. Why anytime anybody mentioned anything about Chinese then it's all about "highly authoritarian state who is known to employ hackers", slave labour, environment, blah blah blah. I'm not saying they don't have these problems but this post has remote speculative prospect to do with Chinese and all

Wrong. A device can only receive up to 100mA without asking for it (like a keyboard, mouse, etc.) The USB spec calls for a 500mA maximum. Many usb devices need more and use 2 ports (like external 2.5" hdds).

It just goes to show you that you can't trust anything that you plug into a computer...

I mean seriously, drivers? For a battery charger? Unless they wanted to display a nifty "charge progress indicator" in the OS... But even then, do they not have a code review before it gets flashed onto the chip?

Some time back, when USB chargers started to appear at airports, I warned that this might happen. A public charging port is such an attractive attack vector.

Of course, the real problem is Windows's "autorun". It was a truly awful idea to have Windows run any executable that appears on any removable device or medium. That went in (in Windows 95, I think) when CDs were only manufactured by major vendors, before home CD writers or USB storage devices. So it probably seemed "safe" at the time.

No no, it didn't seem safe at the time. Everyone who didn't have their head inside their kiester knew it was a gaping security hole.

Golly, I wish some of those people worked at Microsoft.

That's partly because Microsoft (and, by extension, a large chunk of the worlds' Windows software developers) have taken the approach that a PC is only ever used by one person who generally speaking knows what they want the computer to do and can be trusted to do the right thing when the situation demands it - despite decades of experience to the contrary.

To be fair, this attitude has become much less prevalent in their products since XP became the mainstream version of Windows, and even less so with the in

No no, [autorun] didn't seem safe at the time. Everyone who didn't have their head inside their kiester knew it was a gaping security hole.

The security hole is running an unknown/unverified program, and anybody without the sense to disable autorun is going to just click on the installer and get the trojan anyway. Autorun doesn't make the problem worse, it just makes the computer more convenient for most users.

Autorun is not the security hole. As usual, users are the security hole.

This isn't an issue with the charger presenting itself to the OS as a USB mass storage device ; this is an issue with the management software that comes with the device (or you can download it) and presents a graphical charge level monitor.

That went in (in Windows 95, I think) when CDs were only manufactured by major vendors, before home CD writers or USB storage devices. So it probably seemed "safe" at the time.

Many people questioned the safety of autorun win Win95. Auto-running from removable media had already been a problem - one of the first viruses documented as being in-the-wild was distributed on Apple floppies and got itself run via that system's autorun feature (unlike PCs descended from the IBM line and its compatibles several machines and OSs,Apple's machines and Commodor's Amiga lines being two examples, supported detecting a new floppy being inserted) and that was long before Windows 95 hit the market.

At least Windows XP SP2 replaced AutoRun with AutoPlay. Devices (other than music CDs) no longer auto-run, instead asking you what you want to do with it, albeit with the AutoRun-specified item at the top of the list.

This was changed further in Windows Vista/7, so that USB/FireWire drives don't even acknowledge that they have an AutoRun option. Which caused U3 [u3.com] to blatantly abuse this by pretending its U3 partition is a CD-ROM.

Energizer obviously isn't the first company to be hit with this sort of embarrassment, and it's surprising to me how resistant some of these companies are to learning and adopting good QA and security practices.

If corporations feel that they must outsource production of devices like these, they damn well better be prepared to do thorough in-house testing before they release malware to the public. I'll give them the benefit of the doubt that they were probably unaware of this trojan, but that makes them no less negligent.

at least that particular backdoor. Trojans, bots, virus, other backdoors, keyloggers, etc, that went in during the 3 years that you had it installed will be a bit harder to uninstall. Same for the info that you considered safe that went thru your machine (passwords, credit card info, etc).

Anyway, a proper firewall (that at the very least dont let connect to your machine thru not specifically enabled ports) should had stopped most of it.

I would kind of guess "Made In China", and the special edition to the software could easily have been added at this phase. It makes you start to wonder about a lot of products made there, and what they could also be doing. Even something like a motherboard could have all kinds of things going on at a very low level, and who would have a clue?

It gives hex dumps of some of the commands. (Since some of them would obviously require arguments, they clearly can’t be full packets, but they’re signatures of each particular packet.)

All of them follow this pattern:C2 E5 E5 E5 9E8 bytes that are different for each commandC84 bytes that varyC8 D13 bytes that varyC84 bytes that varyC812 bytes that vary98 E5

Graphing the sequences [dumpt.com] showed very obvious trends: Lots of values clustered in approximately the 155-170 range, and lots in the 200-220 range. Also, the 3-byte field that is different for every command has a different clustering pattern.

XORing the patterns with 0-255 yielded the following at 229:'\0\0\0{98D958FC-D0A2-4f1c-B841-232AB357E7C8}\0'\0\0\0{F6C43E1A-1551-4000-A483-C361969AEC41}\0'\0\0\0{783EACBF-EF8B-498e-A059-F0B5BD12641E}\0'\0\0\0{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}\0'\0\0\0{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}\0'\0\0\0{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}\0'\0\0\0{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}\0

Now, colour me surprised, but those look a damn awful lot like CLSIDs...

Yeah, the simple xor 'encryption' is pretty oldschool. I can't believe I didn't notice that right away myself. I didn't see it till I started looking at the send/recv functions.

As to the CLSID, good thought, but no -- the CLSID isn't a real CLSID, it's just a way of identifying its own commands. Basically, it's a list of if(!strcmpi(command, "clsid1")) { do_this() } elseif(!strcmpi(command, "clsid2")) { do_that() } etc.

It only has those 9 or so CLSID's included, and if it isn't on the list the command is

We have fools that buy this junk and then will blame the crackers in CHina that are paid to do this, rather than blame themselves, or the companies that sent the work there in the first place.

Personally, I would like to see some of these Windows ppl SUE Energizer and other companies for selling the products that infect their machines. Force them to pay out 10-100x what they made in profit. Once western companies realize the high costs of doing business there, then and only then will they stop.

The only reason the USB connection is needed is to provide the +5V power. At work, there were computers set to disable USB storage - and to report any attempts to the admins - since flashdrives etc were banned for these same security concerns. Had some small video cameras that needed recharging; 30 seconds with a pair of wire cutters and electrical tape resulted in a USB cable containing only the power and ground wires (no ability whatsoever for data to make it through).
Sounds like this is what Energizer needs to do. There is no need for data transfer in a battery charger, and extra wires put in by a rogue factory are a lot easier to detect than malicious code.

These usually have low mAh values, so that they can be charged reasonably fast and because almost a third of the actual battery is the usb plug and whatever else is needed. For example, what I see on the page is rated 1300 mAh, which sucks, because I can currently purchase 2700mAh batteries for less than the price of those batteries.